Release history

Fixed

• ·The app server now resolves body-parser 2.4.0, closing a high-severity advisory (GHSA-27r3-jxmh-p828) that reached your app at runtime through @react-router/serve and express.
• ·The CLAUDE.md category on the /gaia-fitness grade card is labelled CLAUDE.md instead of claudemd. The JSON report and rule ids are unchanged.
• ·A sentence in the Worktrees wiki page explaining why .gaia/local/ has no allowlist was missing from the shipped page. It is back, and the release build now refuses any maintainer-only marker line that carries other text, so a scrub can no longer drop adopter content silently.

New

• ·/setup-gaia catches a machine up to 2.0.0. On a clone that was on GAIA 1.x, it finds the 1.x leftovers the migration only cleared on the machine that ran it (old local files, the notebook move, Serena, old spec branch names, renamed variables) and fixes each one, asking before anything is deleted or pushed. Every run also checks that git hooks are active and offers to turn them on, so a clone no longer commits without the pre-commit and commit-msg checks unnoticed.
• ·Add a language at any time: ask Claude and it follows the same runbook /gaia-init uses, which now stays in your project.
• ·/gaia-spec reopen SPEC-NNN reopens a saved SPEC whose UAT cannot hold. Claude asks for the reason, records it with the UAT diff, updates the plan steps it affects, and hands back the plan's resume prompt.
• ·Register the finding classes your own Code Audit Team members report in .gaia/finding-classes.json, and /gaia-codify tracks their recurrence like the built-in classes while file-tech-debt files them instead of setting them aside as malformed. The file ships empty and /update-gaia never overwrites it.
• ·A new Customizing GAIA wiki page maps every customization you can make: where it lives, whether /update-gaia merges against it, the how-to page, and the check Claude runs afterwards. The hooks page now has numbered steps for adding, disabling and overriding a hook, and the backend package playbook adds CI and per-stack quality gate steps.
• ·When Claude opens frontend/.claude/settings.json or pnpm-lock.yaml, a new rule names the source to change instead (the root settings or frontend overlay plus gaia packages sync-settings, or pnpm for dependencies), where before the only signal was a bare permission deny.

Improved

• ·Claude takes the steps it used to hand you: a failed /gaia-init step resumes once you confirm the cause is fixed, /setup-gaia offers your GitHub handle for a placeholder CODEOWNERS owner, an in-progress claim is released when Claude closes a pull request unmerged or you drop the work, and after an /update-gaia pull request merges Claude lists the retired leftover files and deletes them on your yes.
• ·/gaia-plan reads a SPEC from its id or its path only. The 1.x SPEC-NNN: <description> hand-off no longer selects a SPEC; pass /gaia-plan SPEC-NNN or the SPEC's path.

Fixed

• ·/gaia-init with two or more added languages no longer stops at the first one's verification. Each language is registered only once its translation files exist, so your project typechecks after every language, at setup or later.
• ·/update-gaia no longer marks the 2.0.0 machine catch-up done without running it. Per-machine setup now waits until the update pull request merges and runs in your main checkout, where the 1.x leftovers actually are.
• ·The hard-reset guard denies git reset --hard to any other commit however it is spelled (HEAD^, @~1, a SHA, a branch name), and says the reset is yours to run.
• ·Guard refusals now say what Claude can do next or that the step is yours, including the pre-commit registry failure, rm -rf node_modules, .env reads, fork pull requests and pushes that name main. The worthiness gate refusal names one path, running the worthiness evaluator, instead of offering a ledger write that skipped the review.
• ·/gaia-codify stops counting findings the audit chose not to fix, so a class that was only ever waived no longer raises a rising-class nudge. After updating you get one "tally changed" review, and classes you declined earlier come back once for a fresh decision.
• ·Registering your own Code Audit Team member works on a fresh project: verify-audit-roster.sh no longer reports GAIA's own files as ownerless, runs in the pre-commit hook when the roster or a member changes, and a member named code-audit-<name> needs no edit to GAIA's machinery list.

Fixed

• ·Saving token usage at the end of a session no longer slows down as your usage ledger grows. GAIA reads the ledger once per save instead of once per transcript file, so closing a workflow that dispatched many agents stops waiting on a save that got longer every week (21 s on a 34 MB ledger, now 6 s), and the false "Some usage was still being saved, so these figures may be low" note no longer reappears as the ledger ages. Existing ledgers need no migration.

New

• ·The pre-merge audit is now a Code Audit Team. Each specialist member owns the files its roster claims, a pull request dispatches only the members whose files it touches, and nothing merges until every one of them clears it. An audit loop runs the rounds away from your session, fixes its own findings, and checks in with you when rounds stop converging. A small change can get a lighter review, and any change not proven small gets the full one.
• ·Every change now follows one lifecycle. Claude claims the GitHub issue, works on its own branch (in a worktree by default) that GAIA provisions (shared state linked in, its own dev, Storybook and Playwright ports), opens a draft pull request, runs the audit, merges when you ask, and cleans up back to a pulled main. Several Claude sessions can work at once without pulling files out from under each other.
• ·Tech debt that pays itself down. Problems the audit finds outside a pull request become deduplicated tech-debt issues instead of blocking your merge, /gaia-debt drains them one audited pull request at a time, and /gaia-residue brings back the trade-offs you accepted at merge so each one is filed, dismissed or kept on purpose.
• ·GAIA now records every model call to a local usage ledger. Each merge prints a cost box (execute, audit, total), /gaia-spec, /gaia-plan and several maintenance commands end with a cost table, and one command totals what an idea cost from first research to merge. Readouts show active time beside wall-clock time, and pricing runs locally with no network request.
• ·Your project is now a pnpm workspace with the React app in frontend/, and a playbook covers adding a backend or another package beside it.
• ·/gaia-react-perf measures React render performance in a real browser and ranks the components whose memoization is defeated.

Improved

• ·GAIA apps now build on shadcn/ui, with Base UI primitives, one theme of role tokens you change by editing values, and pnpm shadcn add <name> for more components. React Compiler is on by default, and components are tested as Storybook stories in real Chromium with accessibility checked on every story, replacing React Testing Library and the emulated DOM.
• ·One route data layer. Services are Ky and Zod modules whose responses are validated, gaia scaffold route writes the route, page, loading fallback and an MSW-backed story, and /gaia-init asks how your backend cases its fields and whether to add TanStack Query (off by default).
• ·Toolchain majors: React Router 8 with first-party file routes, React 19.3, Vitest 5, msw 3, pnpm 12 and Node 22.22 or newer. pnpm’s release-age window, which holds back freshly published packages, is now 3 days and strict. @gaia-react/lint 3.0.0 adds type-aware safety, ReDoS, Effect-misuse and React 19 idiom rules, and every eslint-disable needs a stated reason.
• ·Onboarding is one /setup-gaia command any teammate can re-run safely. It sets up the GitHub repository, registers GAIA-Audit as a required check, and runs only the steps still owed. /gaia-init installs Chromium for the browser tests and starts your project on the lockfile GAIA’s tests ran against.
• ·/update-gaia verifies each release’s checksum, three-way merges every file, asks one question per real conflict and remembers your answers, and claims the update with a draft pull request so two teammates never update at once.
• ·Maintenance commands (/update-deps, /gaia-wiki, /gaia-fitness, /gaia-cleanse, /gaia-codify and the rest) each work on a branch of their own and land as one pull request. /update-deps resolves security advisories first and replaces Dependabot updates, /gaia-fitness grades from a fixed rule catalog and heals one file at a time, and the statusline nudges each command when it has work, fitted to your terminal width.
• ·/gaia-spec audits its own draft against your repo before the final gate, shows everything each gate asks you to approve, and plans the SPEC in the same session. SPECs, plans and research live in one .notebook/ folder shared by every worktree, and SPEC numbers come from git tags so teammates never collide.
• ·Every session loads less GAIA context. Rules and skill instructions are shorter, Claude no longer starts user-only commands such as /setup-gaia and /gaia-fitness on its own, and a context checkpoint saves Claude’s place and asks before a long session runs out. Every finding is graded Critical, Major or Minor, /gaia-harden is now /gaia-codify, and /gaia-audit is now /gaia-cleanse. Subagents, the audit included, run at your session’s effort level.
• ·Simpler by subtraction. Claude no longer runs on GitHub Actions. The audit runs locally and posts GAIA-Audit itself, and the migration removes GAIA CI so it stops spending Claude credit. GitHub spec-kit, the Serena MCP server, /gaia-handoff and /gaia-pickup, the mentorship layer and the claude-obsidian plugin are gone, and a fresh scaffold starts brand-free.

Fixed

• ·Security: three ways the guard layer could silently stop guarding are closed, a hook now denies reading dotenv files, keys and credentials, the client environment is built from an allowlist so server variables such as SESSION_SECRET stay server-only, and the theme and language actions close an open-redirect gap.
• ·The merge gate binds each clearance to the pull request it names, reviews stacked pull requests against their own base, and treats a member refusal as blocking even under auto-merge. Hook guards now catch git and gh commands hidden behind env prefixes, command substitutions and heredocs.

Improved

• ·The full /gaia-wiki maintenance chain opens a single pull request covering sync, consolidate, and lint, instead of a separate pull request for each stage.
• ·/update-gaia clears leftover artifacts from a previous interrupted run when you confirm an update, so each run starts from a clean state.
• ·/update-gaia automatically refreshes a stale Code Review Audit CI workflow, re-rendering it from the current release template, and the refreshed workflow clears the merge gate without a redundant re-audit.

Fixed

• ·Docker builds of GAIA apps copy pnpm-workspace.yaml into their pnpm stages, so the build no longer fails on the missing workspace file.

New

• ·A new /gaia-harden command turns recurring review findings into durable guardrails. When Code Review Audit flags the same kind of problem across three or more pull requests in a rolling 90-day window, GAIA nudges you to run /gaia-harden; it proposes the lightest lasting fix for that pattern (a path-scoped rule, a deterministic check, or a skill) and drafts it for your approval. Nothing lands in your repo without your say-so.
• ·When you run Code Review Audit on CI, it prints a per-phase progress timeline (scope, oracles, review, verification, report) into the GitHub Actions summary, so an otherwise-silent run shows where it is. It carries no tool output or secrets and never blocks the audit.

Improved

• ·/update-deps shows an interactive preview before it changes anything, grouped into major, minor, patch, and non-semver buckets. Snooze the updates you are not ready for: snoozed items drop out of the statusline count and resurface on their own after 14 days or when a newer version ships.
• ·/gaia-audit researches first and presents a single Apply, Discuss, or Decline gate before it touches any file, rather than applying changes end to end. A new CONFLICT class catches entries that contradict an authoritative source, an interrupted run resumes cleanly with a 72-hour grace window before findings need re-checking, and it verifies its own edits after applying.
• ·/gaia-fitness renders its report as a deterministic ASCII card, so the grades and findings read the same in every terminal instead of shifting with the model formatting.
• ·GAIA apps upgrade to pnpm 11.5.2. Workspace settings (dependency overrides, allowed build scripts, hoist patterns) now live in pnpm-workspace.yaml instead of package.json and .npmrc, and /update-gaia migrates them for you field by field, keeping your own overrides and build approvals while applying the release updates.
• ·Dependency refresh: React and React DOM 19.2.7, React Router 7.17.0, Storybook 10.4.2, axe-core 4.12.0, happy-dom 20.10.1, and i18next 26.3.1. Two CVE overrides (brace-expansion and ws) are dropped now that the upstream fixes ship natively.
• ·The TypeScript config adopts two TypeScript 7 prerequisites, stableTypeOrdering and noUncheckedSideEffectImports, while still on TypeScript 6, so the eventual TypeScript 7 upgrade becomes a dependency bump rather than a migration.
• ·Code Review Audit runs its holistic review with a coverage-first pass that surfaces every candidate finding before filtering it, so fewer real issues slip through.
• ·/gaia-plan and /gaia-spec dispatch every subagent from a single orchestrator, so multi-task plans run to completion instead of occasionally stalling, and each task runs on its intended model.

Fixed

• ·react-doctor reads a single doctor.config.jsonc. If you still have a legacy react-doctor.config.json, rename it.
• ·/update-gaia no longer dead-ends when you interrupt a run partway through: it defers the version-file bump until after the summary prints, so a resumed run picks up from the right baseline instead of reporting it is already up to date.
• ·/update-deps no longer points at a maintainer-only file path that does not exist on your clone.

New

• ·The tdd skill mechanically verifies the RED phase: it confirms a new test actually fails before you write the implementation, catching tests that pass by accident before they mask missing behavior.
• ·Code Review Audit now flags known-vulnerable dependencies: a pnpm audit pass surfaces high and critical CVEs during pre-merge review as an advisory, so you see them without blocking the merge.
• ·The wiki commands (/gaia-wiki sync, consolidate, lint) ship with native checks instead of depending on the external claude-obsidian plugin.

Improved

• ·The /gaia <subcommand> router is replaced by discrete /gaia-* commands, so every workflow appears in slash-command autocomplete: /gaia-plan, /gaia-spec, /gaia-audit, /gaia-fitness, /gaia-forensics, /gaia-wiki, /gaia-handoff, and /gaia-pickup. The old space-form /gaia <sub> is removed; sub-arguments are unchanged (for example /gaia-wiki sync). If you call the old form in scripts or notes, switch to the matching /gaia-<sub> command.
• ·The Code Review Audit merge gate skips pull requests that change only docs, wiki, or metadata, so a docs-only change merges without waiting on an audit marker.

Fixed

• ·/update-gaia merges your package.json field by field instead of as one opaque block: it never touches your name, version, description, or author, applies only the real dependency and script changes from the release, and never re-adds a dependency you removed. A version-only release now skips package.json entirely instead of raising a full-file conflict every time.

Fixed

• ·/update-gaia no longer re-adds files you intentionally deleted.
• ·/update-gaia only raises conflicts for files that actually changed in the release, instead of flooding you with spurious patches.
• ·Wiki entries take their dates from your system clock instead of the model, so timestamps are always correct.

New

• ·Dependency supply-chain hardening: new package versions are quarantined for 7 days before GAIA installs them, and downgrades are blocked, defending against a compromised fresh release.
• ·GAIA apps now ship with a Content-Security-Policy that restricts which scripts can run, hardening them against script injection.

Improved

• ·Code Review Audit on CI is now opt-in and installs on demand. When it runs, it only audits changes since the last green run instead of the whole codebase, so CI is faster and cheaper.
• ·React Router v8 future flags are enabled so your app is ready for the v8 upgrade early. One flag (v8_passThroughRequests) changes how loaders and actions receive the request: if you have customized app/root.tsx, a small migration is needed. See the full changelog for exact steps.
• ·Kickoff prompts print to the terminal instead of silently copying to your clipboard.

Fixed

• ·Form/Chain merges class names with twMerge, so your utility classes override the component's defaults instead of conflicting with them.

New

• ·/setup-gaia-ci now detects when your committed GAIA CI workflow files have drifted from what GAIA would generate today. On a re-run it compares each tool's workflow YAML against a fresh render and reports what is out of sync, then offers to re-render, skip, or fully reconfigure instead of silently doing nothing. A new drift-fix path opens a branch and PR that regenerates only the workflow YAML, leaving your tool selection and bot token untouched.

Fixed

• ·/update-gaia now finishes a full run and opens a pull request at the end, instead of leaving the update stranded on a branch.
• ·/update-gaia records the new version correctly when it busts its cache.

New

• ·GAIA apps now ship with a per-request nonce Content-Security-Policy, so only scripts carrying the request nonce can run and inline injection is blocked.
• ·axe-core accessibility testing is wired into both Vitest and Playwright, so you can catch a11y violations in unit tests and end-to-end flows.
• ·/gaia plan and /gaia spec can run concurrently in separate sessions without clashing. Atomic writes keep racing sessions from corrupting committed state.

Improved

• ·GAIA apps detect client hints with a pre-paint inline script instead of a reload, removing the flash and extra page load on first visit.
• ·The /setup-gaia command is renamed to /setup-cloned-gaia-project.

Fixed

• ·The Checkboxes, FieldDescription, and TextArea components ship accessibility fixes, including a dropped nested live region that screen readers announced incorrectly.
• ·Form components handle edge cases correctly across the board.
• ·GAIA apps reject non-local redirect targets and close an XSS vector, so a crafted redirect or payload cannot send users off-site or run injected markup.

Fixed

• ·Running two planning or orchestration sessions at once no longer corrupts shared state: a running sentinel detects a concurrent orchestrator, and plan creation uses an atomic directory claim to avoid a race.
• ·Husky git hooks now run on Linux and WSL.

New

• ·/gaia fitness, a command that audits your project's Claude integration, auto-heals the problems it finds, and reports a health grade so you can tell at a glance whether your setup is in good shape.

New

• ·Accessibility testing is built in: axe-core runs in both Vitest and Playwright, so your components and user flows are checked for a11y violations as part of the normal test suite.
• ·Dead-code detection via knip. Run pnpm knip after refactors or before release-candidate PRs to find unused files, exports, and dependencies. The config is template-aware, so intentional exports in your library surface are not flagged.
• ·Serena MCP gives Claude LSP-backed code intelligence for fast, accurate TypeScript and TSX symbol lookups instead of text search. Registered by /gaia-init; requires uv.
• ·/gaia forensics turns a workflow misfire into a redacted, filing-ready bug report in one pass.

Improved

• ·**BREAKING:** the /wiki-sync, /wiki-consolidate, and /wiki-lint slash commands are removed. Use /gaia wiki sync, /gaia wiki consolidate, /gaia wiki lint, or /gaia wiki for the full chain. This resolves a name collision with the claude-obsidian plugin. See the full changelog for details.
• ·/gaia audit no longer covers intra-wiki duplication or broken-wikilink checks, which overlapped with the wiki commands. Run /gaia wiki separately for wiki-internal audits.

Improved

• ·/gaia-init now asks for your primary language and any additional locales when it scaffolds a project, with an opt-out path that strips i18n entirely.

Fixed

• ·The /update-deps and /update-gaia prompts move to the statusline, so they stay visible instead of firing once where you might miss them.

Fixed

• ·A fresh pnpm install of a GAIA app no longer prints the pnpm build-script approval warning: the build scripts for core-js-pure, esbuild, msw, and unrs-resolver are pre-approved.

Fixed

• ·Running /init in a GAIA project now redirects you to /gaia-init reliably, and the "blocked by hook" banner no longer appears.